M67854-18-R-2023 PPIP Special Instructions.docx
DOCX document 42 KB Posted
- Attached to
- MAGTF Common Handheld (MCH)
- Solicitation number
- M67854-18-R-2023
- Issued by
-
United States Marine Corps
About this file
This document outlines special instructions for a Program Protection Implementation Plan (PPIP) in support of a solicitation for the MAGTF Common Handheld (MCH) system. The contractor shall provide updated criticality analyses, threat assessments, vulnerability assessments, and countermeasures based on the current threat environment and implementation of the MCH Integrated Platform. The contractor shall also describe trusted supplier measures, security engineering practices, plans for program protection risk assessments and mitigations, and support for security audits and inspections. References are provided for program protection, supply chain risk management, security standards, and Marine Corps acquisition documents.
CDRL Attachment
View the file
Other files
Show 40 more
Latest 50 of 69 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
| Solicitation: M67854-18-R-2023 | CDRL Exhibit: B | |
| Project: MAGTF Common Handheld | CDRL Sequence: 002 | |
| Attachment Number: 1 |
REQUIREMENTS
The requirements for the above referenced item are contained in this form, and referenced documents, of the issue in effect on the date of Invitation for Bid or Request for Proposal.
PROGRAM PROTECTION IMPLEMENTATION PLAN (PPIP)
Special Instructions/Limitations/Tailoring:
A. The contractor shall list planned support for program protection events, including Critical Program Information (CPI) and critical function/component identification/updates, Acquisition Security Database (ASDB) updates, threat assessment requests, vulnerability assessments, red team events, security audits/inspections , Systems Engineering Technical Reviews (SETRs), countermeasure (e.g. anti-tamper, information assurance), and testing/verification events.
B. The contractor shall supply an updated criticality analysis, set of threats, vulnerabilities, and countermeasures based upon current threat conditions and the contractor’s implementation of the MCH Integrated Platform.
C. The contractor shall describe Trusted Supplier measures and system security engineering practices applied in the contractor’s implementation of the MCH Integrated Platform.
D. The contractor shall describe planned support for initial and updated Program Protection Risk Assessments which will include risks and planned mitigations to reduce risk likelihood and probability.
E. The contractor shall describe planned support for security audits and inspections applied in the contractor’s implementation of Program Protection.
F. PPIP updated References (Chairman Joint Chiefs Publications http://www.jcs.mil/Library/)
(1) CJCSI 6211.02D, Defense Information System Network (DISN), Responsibilities (24 Jan 12).
(2) CJCSM 6510.01B, Cyber Incident Handling Program (10 July 12).
G. PPIP updated References (DoD Publications/Manuals http://www.esd.whs.mil/Directives/issuances/dodm/)
(1) DoDM 5200.01, Volume 1, DoD Information Security Program: Overview, Classification, and Declassification (24 Feb 12).
(2) DoDM 5200.01, Volume 2, DoD Information Security Program: Marking of Classified Information (24 Feb 12, C-2 19 Mar 13).
(3) DoDM 5200.01, Volume 3, DoD Information Security Program: Protection of Classified Information (24 Feb 12, C-2 19 Mar 13).
(4) DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI) (24 Feb 12).
(5) DoD 5200.1-M, DoD Acquisition System Protection Program (16 Mar 94).
(6) DoD 5200.08-R, Physical Security Program (09 Apr 07 C-1, 27 May 09) (also see DTM-09-012 and DTM-08-004).
(7) DoD 5205.02M, DoD OPSEC Program (03 Nov 08).
(8) DoD M O-5205.13, Defense Industrial Base (DIB) Cyber Security and Information Assurance (CS / IA) Program Security Classification Manual (SCM) (26 Apr 12).
(9) DoD 5220.22 M, National Industrial Security Program Operating Manual (NISPOM) (01 Feb 06) (also see DTM-09-019).
(10) DoD 5230.25-PH, Control of Unclassified Technical Data with Military or Space Application (06 Nov 84, C-1, 18 Aug 95).
(11) DoD 5240.1-R, Procedures Governing the Activities of DoD Intelligence Components that Affect United States Persons, (01 Dec 82) (also see DTM 08-052, DoD Guidance for Reporting Questionable Intelligence Activities and Significant or Highly Sensitive Matters (17 Jun 09 Incorporating Change 3, 30 Jul 12) and DTM-08-011, Intelligence Oversight Policy Guidance (26 Mar 2008 Incorporating Change 3, 27 Jul 12)).
H. PPIP updated References (DoD Directives http://www.esd.whs.mil/Directives/issuances/dodd/)
(1) DoDD 5000.01, The Defense Acquisition System (12 May 03; Certified Current as of 20 Nov 07).
(2) DoDD 5205.02E, DoD OPSEC Program (20 June 12).
(3) DoDD 5230.09, Clearance of DoD Information for Public Release (22 Aug 08, Cert. Current thru 22 Aug 15).
(4) DoDD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations (16 Jun 92).
(5) DoDD 5230.20, Visits and Assignments of Foreign Nationals (22 Jun 05).
(6) DoDD 5230.25, Withholding of Unclassified Technical Data from Public Disclosure (06 Nov 84, Incorporating Change 1, 18 Aug 95).
(7) DoDD 8100.02, Use of Commercial Wireless Devises, Services and Technologies in the DoD Global Information Grid (14 Apr 04, Cert. Current as of 23 Apr 07).
I. PPIP updated References (DoD Instructions http://www.esd.whs.mil/Directives/issuances/dodd/)
(1) DoDI 2040.02, International Transfers of Technology, Articles, and Services (27 Mar 14).
(2) DoDI 4140.01, DoD Supply Chain Materiel Management Policy (14 Dec 11).
(3) DoDI 4140.67, DoD Counterfeit Prevention Policy (26 Apr 13).
(4) DoDI 4160.28, DoD Demilitarization (DEMIL) Program (07 Apr 11).
(5) DoDI 5000.02, Operation of the Defense Acquisition System (07 Jan 15, Incorporating Change of 10 Aug 17).
(6) DoDI 5200.08, Security of DoD Installations and Resources and the DoD Physical Security Review Board (PSRB) (10 Dec 05, C-1, 19 May 10) (also see DTM-08-004, DTM-09-012).
(7) DoDI 5200.39, Critical Program Information (CPI) Identification and Protection Within Research, Development, Test, and Evaluation (RDT&E) (20 May 15).
(8) DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN) (25 Aug 16).
(9) DoDI 5230.24, Distribution Statements on Technical Documents (23 Aug 12, Incorporating Change of 28 Apr 16).
(10) DoDI O-5240.24, Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA) (08 Jun 11, C-1, 15 Oct 13).
(11) DoDI 8420.01, Commercial Wireless Local-Area Network (WLAN) Devices, Systems, and Technologies (03 Nov 09).
(12) DoDI 8500.01, Cybersecurity (14 Mar 14).
(13) DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) (IA) (12 Mar 14).
(14) DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PKI) Enabling (21 May 11) (IA).
(15) DoDI 8580.1, Information Assurance (IA) in the Defense Acquisition System (09 Jul 04) (IA).
(16) DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Information Systems (06 Jun 12) (IA).
(17) DoDD 5200.47E, Anti-Tamper, (04 Sept 15).
J. PPIP updated References (Department of the Navy (OPNAV/SECNAV) http://doni.daps.dla.mil/SECNAV.aspx)
(1) OPNAVINST 3432.1A, OPSEC, (04 Aug 11).
(2) OPNAVINST 3811.1E, Threat Support to the Defense Acquisition System, (04 Jan 12).
(3) OPNAVINST 5239.3A, Navy Implementation of DoD Intelligence Information System (DODIIS) Public Key Infrastructure (PKI) (18 Jan 08).
(4) OPNAVINST 5530.14E, Navy Physical Security and Law Enforcement Program (28 Jan 09, C 23, Sep 14).
(5) SECNAVINST 5000.2E, DoN Implementation and Operation of the Defense Acquisition System and the Joint Capabilities Integration and Development System (01 Sep 11).
(6) SECNAVINST 5200.39A, Participation in the Government Industry Data Exchange (GIDEP), (25 Dec 05).
(7) SECNAVINST 5510.36A, DoN Information Security Program (ISP) Instruction (06 Oct 06).
(8) SECNAV M- 5510.36, DoN Information Security Program, (Jun 06).
K. PPIP updated References (Other DoD/Navy Publications (Available via ASSIST / internet):
(1) Memorandum for Secretaries of the Military Departments, Overarching DoD Counterfeit Prevention Guidance (16 Mar 12).
(2) DoD CIO MEMO, Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Devices (07 Jul 07) (Available via internet).
(3) DAG Chapter 13, Program Protection, the Defense Acquisition Guidebook (Most current Defense Acquisition University version) (Available via DAU on the internet).
(4) Key Practices and Implementation Guide for the DoD Comprehensive National Cybersecurity Initiative 11 Supply Chain Risk Management Pilot Program (25 Feb 10).
(5) DI-QCIC-80125B, Government Industry Data Exchange Program (GIDEP) Alert/Safe-Alert Report (05 May 03) (Available via internet).
(6) DI-QCIC-80126B, Government Industry Data Exchange Program (GIDEP) (05 May 03) (Available via internet).
L. PPIP updated References (Presidential Executive Orders (Available via internet) / Public Laws)
(1) E.O. 12968, Access to Classified Information, (02 Aug 95, as amended).
(2) E.O. 13526, Classified National Security Information (29 Dec 09).
(3) E.O. 13587, Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information (07 Oct 11).
(4) NSPD-54/HSPD23, National Security Presidential Directive 54, in conjunction with Homeland Security Directive-23 (02 Mar 10).
(5) NSDD 298, National Security Decision Directive, National Operations Security Program (22 Jan 88).
(6) OMB A-130 Appendix III, Security of Federal Automated Information Resources (Circular No A-130) (IA).
(7) OMB Policy Letter 91-3, Reporting Nonconforming Products, (09 Apr 91).
(8) Defense Authorization Act 254, National Defense Authorization Act, Senate Report 109-254.
(9) P.L. 87-794, Trade Expansion Act of 1962 (76 Stat. 872, enacted 11 Oct 62, 19 U.S.C. § 1801).
(10) P.L. 96-72, Export Administration Act of 1979 (Title 50, U.S.C., App. 2401 et seq) (79).
(11) P.L. 104-106, Information Technology Management Reform Act, Division E, (Clinger-Cohen Act) (10 Feb 96).
(12) P.L. 104-231, Freedom of Information Act, As Amended by 104-231, 110 Stat5 U.S.C. § 552, 3048.
(13) P.L. 112-81, Section 818 (f) (2) and (c) (2), Defense Auth. Act for Fiscal Year 2012.
(14) P.L. 112-239, Section 833, Defense Auth. Act for Fiscal Year 2013.
M. PPIP updated References (Federal Acquisition Regulations (FARS) / Defense Acquisition Regulations (DFARS) (Available via internet / COR / PCO))
(1) DFARS 252-204-7012, Safeguarding of Unclassified Controlled Technical Information (18 Nov 13).
(2) DFARS 246.407, Nonconforming Supplies/Services, Government Contract Quality Assurance (01 Aug 10).
(3) DFARS 252.246-7003, Defense Federal Acquisition Regulations Supplement Notification of Potential Safety Issues (Revised 03 Mar 08).
(4) DFARS 2012-D055, Detection and Avoidance of Counterfeit Electronic Parts.
(5) DFARS 2013-27311, Requirements Relating to Supply Chain Risk.
(6) FAR 45.101, Demilitarization.
(7) FAR Subpart 46.4, Government Contract Quality Assurance.
(8) FARS 252.217.7026, Identification of Sources of Supply.
N. PPIP updated References (Other Applicable National Standards / Publications (Available via internet / COR / PCO))
(1) NSTISSAM TEMPEST/2-95, With NSTISSAM TEMPEST/2-95A Amendment, Red/Black Installation Guidance, (Document is FOUO) (IA) (Controlled Document Contractors formally request via PCO/Contracting Officer).
(2) NSTISSAM TEMPEST/1-92, Compromising Emanations Laboratory Test Requirements, Electromagnetics, (Document is Confidential) (IA) (Controlled Document Contractors formally request via PCO / Contracting Officer).
(3) CNSSI 1001, National Instruction on Classified Information Spillage (Feb 08) (Available via internet).
(4) CNSS-NSTISS 7000, TEMPEST Countermeasures for Facilities (U) (May 04) (S/NF) (De-Classified 1993 Document) (IA) (Formally request via PCO/Contracting Officer).
(5) CNSSI 4009, National Information Assurance (IA) Glossary (26 April 10) (Available via internet).
(6) CNSSD 505, Supply Chain Risk Management (SCRM) (07 Mar 12).
(7) FISMA, Title III, Public Law 107-347, Federal, Information Security Management Act of 2002 (H. R. 2458-48) (Dec 02) (IA) (Available via internet).
(8) Title 18 Section 1831, Economic Espionage, et seq. (Jan 08) (Available via internet).
(9) Title 22, Chapter 39, Arms Export Control Act, (U.S.C., Sec 2751, et seq.) (04 Jan 12) (Available via internet).
(10) NIST SP 800-59, Guideline for Identifying an Information System as a National Security System (Aug 03) (Available via internet/NIST).
O. PPIP updated References (Military Standards (Available via ASSIST at http://quicksearch.dla.mil/))
(1) MIL-HDBK-350, Corrective Action and Disposition System for Nonconforming Material (07 Jun 91).
(2) MIL-STD-461F, DoD Interface Standard: Requirements for the Control of Electromagnetic Interference Characteristics of Subsystems and Equipment (10 Dec 07).
(3) MIL-STD-464C, DoD Interface Standard: Electromagnetic Environmental Effects Requirements for Systems (01 Dec 10).
(4) Mil-STD 882E, Department of Defense safety Standard Practice System (SCRM) (11 May 12).
P. PPIP updated References (Supply Chain Risk Management (SCRM) Program Management (Available via Internet / NIST / commercial sources))
(1) SO300-BT-PRO-010, Government Industry Data Exchange Program (GIDEP) Operations Manual (w/ 10 Sep 10 updates).
(2) NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View (Mar 11).
(3) NIST SP 00-59, Guideline for Identifying an Information System as a National Security System.
(4) NIST IR 7622, Piloting Supply Chain Risk Management Practices for Federal Information Systems (Jun 10).
(5) NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (10 Jun 14).
(6) DoD Key Practices and Implementation Guide for the DoD Comprehensive National Cybersecurity Initiative 11 Supply Chain Risk Management Pilot Program (25 Feb 10).
(7) CNSS No. 505, Supply Chain Risk Management (01 Aug 17).
(8) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-30, Rev 1, Guide for Conducting Risk Assessments (Sep 12).
(9) NIST SP 800-53r4, Security and Privacy Controls for Federal Information Systems and Organizations.
Q. PPIP updated References (SCRM Industry Standards (pertain to electronic components, standard industry practice available via commercial sources))
(1) ANSI / EIA-4899, Standard for Preparing an Electronic Component Management Plan (02).
(2) IDEA-STD-1010B, Acceptability of Electronic Components Distributed in the Open Market (Apr 11).
(3) AS9120 Rev C, Quality Management Systems for Aerospace Product Distributors (Jun 12).
(4) SAE-AS5553, Counterfeit Electronic Parts; Avoidance, Detection, Mitigation, and Disposition (09).
R. PPIP updated References (Marine Corps Documents)
(1) MARCORSYSCOM Order 5000.3B, 14 Aug 15, Implementation of Marine Corps Systems Command (MARCORSYSCOM) Acquisition Tools.
(2) MARCORSYSCOM Acquisition Guidebook (MAG) (Feb 16) https://dap.dau.mil/policy/Documents/2017/MAG_Update_03Feb2017.pdf.
(3) MCSC Order 4130.1, Configuration Management (CM) Policy (06 Jan 10).
(4) MCO 5239.2a, Marine Corps Cybersecurity Program (18 Jul 12).
S. PPIP updated References (NSA Commercial Solutions for Classified (CSfC) Program documents)
(1) NSA CSfC Mobile Access Capability Package, Version 1.1, (19 Jun 15).
(2) NSA CSfC Data-At-Rest Capability Package, Version 3.0, (Mar 16).
(3) NSA CSfC Campus Wireless Local Area Network Capability Package, Version 2.0, (27 Apr 16).
File details come from the government source that posted it. Updated .